# Filebeat no connection could be made because the target machine actively refused it

**URL:** <https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302>\
**Category:** Logstash\
**Created:** [May 6, 2021, 1:19pm UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302 "2021-05-06T13:19:53Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rashmika\_Gamage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmika_gamage/32/88321_2.png) [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\
**Post date:** [May 6, 2021, 1:19pm UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/1 "2021-05-06T13:19:53Z")

</div>

Hi all,

I am trying to read logs from beats to logstash in the same machine.  
I am getting an error _no connection could be made because the target machine actively refused it_

My logstash conf file

```
input {
    beats {
        port => 6523	
    }
}
 
filter {
  #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
  if [message] =~ "\tat" {
    grok {
      match => ["message", "^(\tat)"]
      add_tag => ["stacktrace"]
    }
  }
 
}
 
output {
   
  stdout {
  }
 
  # Sending properly parsed log events to elasticsearch
  elasticsearch {
    hosts => ["localhost:9200"]
	index => "%{[@metadata][beat]}-%{[@metadata][version]}" 
  }
}

```

}

My filebeat.yml is

```auto
filebeat.inputs:

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - D:\var\log\*
    #- c:\programdata\elasticsearch\logs\*

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["127.0.0.1:6523"]

```

Appreciate if someone can help me. I read all other posts but didn't help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 6, 2021, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/2 "2021-05-06T14:35:54Z")

</div>

By default a beats input will listen on 0.0.0.0. What that means depends on the TCP stack, it certainly can mean different things on different stacks. You are trying to connect to 127.0.0.1, which is one of the many addresses on the loopback interface. I suggest you configure the beats input to explicitly listen on that address.

```
host => "127.0.0.1"
```

---

<div class="post-metadata">

**Author:** ![Rashmika\_Gamage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmika_gamage/32/88321_2.png) [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\
**Post date:** [May 6, 2021, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/3 "2021-05-06T14:50:39Z")

</div>

Hi thank you for your reply. I updated but i got same error

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 6, 2021, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/4 "2021-05-06T16:02:59Z")

</div>

What do you have in logstash logs? Start logstash and share the logs to see if there is any indication of what is causing this issue.

---

<div class="post-metadata">

**Author:** ![Rashmika\_Gamage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmika_gamage/32/88321_2.png) [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\
**Post date:** [May 6, 2021, 4:16pm UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/5 "2021-05-06T16:16:13Z")

</div>

Hi,

Thank you for the reply.There is no error logs in logstash

```auto
[2021-05-06T19:42:10,628][INFO][logstash.runner] Log4j configuration path used is: C:\Program Files\ELK Stack\logstash-7.12.1\config\log4j2.properties
[2021-05-06T19:42:10,657][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.12.1", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 25.211-b12 on 1.8.0_211-b12 +indy +jit [mswin32-x86_64]"}
[2021-05-06T19:42:10,912][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2021-05-06T19:42:13,480][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2021-05-06T19:42:16,016][INFO][org.reflections.Reflections] Reflections took 94 ms to scan 1 urls, producing 23 keys and 47 values 
[2021-05-06T19:42:24,240][INFO][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
[2021-05-06T19:42:24,662][WARN][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=>"http://localhost:9200/"}
[2021-05-06T19:42:24,772][INFO][logstash.outputs.elasticsearch][main] ES Output version determined {:es_version=>7}
[2021-05-06T19:42:24,780][WARN][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2021-05-06T19:42:24,916][INFO][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://localhost:9200"]}
[2021-05-06T19:42:25,059][INFO][logstash.outputs.elasticsearch][main] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2021-05-06T19:42:25,244][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, "pipeline.sources"=>["D:/2.Data Engineer/ELK/logstash.conf"], :thread=>"#<Thread:0x626174fe run>"}
[2021-05-06T19:42:25,314][INFO][logstash.outputs.elasticsearch][main] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2021-05-06T19:42:27,228][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>1.97}
[2021-05-06T19:42:29,744][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}
[2021-05-06T19:42:29,888][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 6, 2021, 4:48pm UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/6 "2021-05-06T16:48:31Z")

</div>

You should have a message

```
[INFO][logstash.inputs.beats][main] Beats inputs: Starting input listener {:address=>"127.0.0.1:6523"}

```

If that is missing it suggests you are not running the configuration that you think you are.

---

<div class="post-metadata">

**Author:** ![Rashmika\_Gamage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmika_gamage/32/88321_2.png) [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\
**Post date:** [May 7, 2021, 4:59am UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/7 "2021-05-07T04:59:25Z")

</div>

Hey thank you for the reply

Why i don't get any output from logstash after this

```auto
2021-05-07T10:26:27,570][INFO][filewatch.observingtail][main][56b3e5a1c7def459acdd04c5ae6a0b797103bdcb8a6d484324574bfa87fd502c] START, creating Discoverer, Watch with file and sincedb collections
```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 7, 2021, 5:14am UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/8 "2021-05-07T05:14:07Z")

</div>

How are you starting logstash and what do you have in this file: `D:\2.Data Engineer\ELK\logstash.conf`?

This is the config that your logstash is running, it is the same that you shared before?

---

<div class="post-metadata">

**Author:** ![Rashmika\_Gamage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmika_gamage/32/88321_2.png) [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\
**Post date:** [May 7, 2021, 5:23am UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/9 "2021-05-07T05:23:54Z")

</div>

HI, I added

```auto
sincedb_path => "NULL"

```

This line to input of logstash conf file

---

<div class="post-metadata">

**Author:** ![Rashmika\_Gamage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmika_gamage/32/88321_2.png) [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\
**Post date:** [May 7, 2021, 8:55am UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/10 "2021-05-07T08:55:23Z")

</div>

Thank you for all giving your valuable time. really appreciate it. I resolved the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2021, 8:56am UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302/11 "2021-06-04T08:56:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.